US20070294404A1 - Method and system for authorization and access control delegation in an on demand grid environment - Google Patents

Method and system for authorization and access control delegation in an on demand grid environment Download PDF

Info

Publication number
US20070294404A1
US20070294404A1 US11/453,487 US45348706A US2007294404A1 US 20070294404 A1 US20070294404 A1 US 20070294404A1 US 45348706 A US45348706 A US 45348706A US 2007294404 A1 US2007294404 A1 US 2007294404A1
Authority
US
United States
Prior art keywords
moderator
entities
access control
grid node
control list
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US11/453,487
Inventor
Irwin Boutboul
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
International Business Machines Corp
Original Assignee
International Business Machines Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by International Business Machines Corp filed Critical International Business Machines Corp
Priority to US11/453,487 priority Critical patent/US20070294404A1/en
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION reassignment INTERNATIONAL BUSINESS MACHINES CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BOUTBOUL, IRWIN
Publication of US20070294404A1 publication Critical patent/US20070294404A1/en
Priority to US12/060,299 priority patent/US8935417B2/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101Access control lists [ACL]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/04Network management architectures or arrangements
    • H04L41/044Network management architectures or arrangements comprising hierarchical management structures
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823Network architectures or network communication protocols for network security for authentication of entities using certificates

Definitions

  • the embodiments of the invention generally relate to computer security, and, more particularly, to computer security and access control in grid computing environments.
  • Grid computing In grid computing, heterogeneous resources distributed geographically are virtualized as a unified whole. Grid computing, as a result, provides enormous opportunity in terms of resource sharing, maximization of resource utilization and virtualization of resources. Grid computing has potential for the not only the scientific community, but also the enterprise information technology (IT) communities.
  • IT enterprise information technology
  • System level security issues deal with the problem of running a foreign application in one's system.
  • Architectural security issues deal with the development of a secure infrastructure for the grid system.
  • Interoperability issues include establishing a secure infrastructure including encryption, authentication and authorization in a grid based environment.
  • U.S. Pat. No. 6,901,448, incorporated herein by reference discloses a method for a distributed collaborative computing environment and a security protocol involving encryption processes.
  • U.S. Pat. No. 7,028,181, incorporated herein by reference discloses a system and method for revocation of a signature certificate in a PKI.
  • the method of the present invention provides for flexible on-demand authorization and authentication of entities wishing to access grid nodes, when the grid is used for real time collaboration between different parties.
  • the method of the invention provides for dynamic on-demand delegation of control and access in a grid computing environment comprising: granting authority of a grid node to a moderator by a superauthority; admitting the moderator, which is a user having special access, to the grid node; modifying the access control list of the grid node by the moderator; inviting other entities listed on the access control list to access the grid node; and said moderator issuing a unique authorization certificate to each of the other entities, wherein the moderator controls the inviting of the other entities without the need for contact with or access to the superauthority for certification.
  • an embodiment of the invention provides that the modification of the access control list of the grid node includes adding or deleting/removing other entities (e.g., client, users, etc.) on the grid node's access control list.
  • Embodiments of the invention further comprise the moderator delegating authority to priviledged users or additional moderators.
  • the moderator controls the delegation of privileged users or additional moderators without contacting or accessing the superauthority for certifications or authorization. It will be understood to those of skill in the art that as used herein, the terms additional moderator or priviledged user may be used interchangeably herein.
  • the modification of the access control list can be performed by either the moderator or the priviledged user.
  • the privileged users cannot revoke or remove the moderator's authority to assign new priviledged users or moderators or assign new users to the access control list of the grid node.
  • the priviledged users or additional moderators can delegate other moderators in addition to modifying the access control list.
  • FIG. 1 illustrates a flow diagram illustrating a preferred method of an embodiment of the invention.
  • FIG. 2 is a schematic diagram of a the communication network of moderator, superauthority, node and client (user);
  • FIG. 3 is representative hardware environment for practicing the embodiments of the invention.
  • FIGS. 1 through 3 where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments of the invention.
  • FIG. 1 illustrates a flow diagram of the.
  • a method for dynamic delegation of control in a grid computing environment comprising: granting authority of a grid node to a moderator, which is a user having special access, by a superauthority ( 100 ); admitting the moderator to the grid node ( 102 ); modifying an access control list (ACL) of the grid node by the moderator ( 108 ).
  • the modification of the access control list includes adding or deleting other entities (e.g., users, clients, etc.).
  • the method further comprises inviting the other entities listed on the access control list to access the grid node ( 104 ); and the moderator, or in certain embodiments, priviledged user, issuing a unique authorization certificate to each of the other entities ( 106 ), wherein the moderator controls the inviting of the other entities without the need for the moderator or the other entities to contact the superauthority for authorization certificates.
  • the method further comprises steps wherein the moderator delegates authority to privileged users (additional moderators) ( 110 ).
  • the first moderator controls the delegation of privileged users having moderator abilities without the need for contact with the superauthority.
  • the first moderator and privileged users have the authority to modify the access control list and assign or remove new moderators.
  • the privileged users have all the authority of a moderator with the exception that privileged users may not remove the first moderator from the grid node. The moderator may remove himself from the node and assign a new moderator, having the full authority of the first moderator.
  • Moderators can be considered within the context of the invention users with the same privileges of a super authority, i.e., “super users.” Thus, moderators have superior access control and abilities that the regular users do not have.
  • the super authority is an authority which grants authorization certificates to moderators of a node and can make a regular user a ‘super user’ or moderator, by granting specific credentials (X509 certificates usually).
  • a moderator e.g., a super user
  • Privileged users i.e., additional moderators, are granted different abilities. The most basic one is to get access to the resources, and the other ability they can be granted by the super user/moderator is the ability to make other people privileged users and/or remove their privileged ability. The only thing that privileged users will not be able to do is revoke the ‘super user’ ability of the super user. In that sense, the super user will always have overriding capabilities over its delegated privileged users.
  • a super user/moderator can grant any capability to privileged users can be anything and everything, and should not be limited, e.g., granting access to local machine/node and granting ability to delegate this access to other people.
  • Another embodiment of the invention involves a computer program product readable by machine, tangibly embodying a program of instructions executable by said machine to perform the method for dynamic delegation of control in a grid computing environment described herein.
  • Yet another embodiment of the invention is a service for dynamic delegation of control in a grid computing environment comprising: granting authority of a grid node to a first moderator by a superauthority; admitting the first moderator entity to the grid node; modifying an access control list of the grid node by the first moderator; inviting other entities listed on the access control list to access the grid node; and issuing a unique authorization certificate to each of the other entities.
  • FIG. 2 illustrates schematically the various entities in the method described herein.
  • the moderator receives a certificate from the central authority/superauthority ( 200 ) to access the grid node ( 206 ) and to modify access to the grid node.
  • the moderator ( 204 ) which controls modification of the access control list, assignment or removal of clients (e.g., user, entities, etc.) ( 202 ) to the grid node ( 206 ).
  • FIG. 3 illustrates a flow diagram according to an embodiment of the invention.
  • the embodiments of the invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment including both hardware and software elements.
  • the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
  • the embodiments of the invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system.
  • a computer-usable or computer readable medium can be any apparatus that can comprise, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
  • the medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium.
  • Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk.
  • Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.
  • a data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus.
  • the memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
  • I/O devices can be coupled to the system either directly or through intervening I/O controllers.
  • Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
  • FIG. 3 A representative hardware environment for practicing the embodiments of the invention is depicted in FIG. 3 .
  • the system comprises at least one processor or central processing unit (CPU) 10 .
  • the CPUs 10 are interconnected via system bus 12 to various devices such as a random access memory (RAM) 14 , read-only memory (ROM) 16 , and an input/output (I/O) adapter 18 .
  • RAM random access memory
  • ROM read-only memory
  • I/O input/output
  • the I/O adapter 18 can connect to peripheral devices, such as disk units 11 and tape drives 13 , or other program storage devices that are readable by the system.
  • the system can read the inventive instructions on the program storage devices and follow these instructions to execute the methodology of the embodiments of the invention.
  • the system further includes a user interface adapter 19 that connects a keyboard 15 , mouse 17 , speaker 24 , microphone 22 , and/or other user interface devices such as a touch screen device (not shown) to the bus 12 to gather user input.
  • a communication adapter 20 connects the bus 12 to a data processing network 25
  • a display adapter 21 connects the bus 12 to a display device 23 which may be embodied as an output device such as a monitor, printer, or transmitter, for example.
  • a third party is not required for the delegation of control during the process to achieve scalability.
  • entity A e.g., the moderator
  • machine X e.g., the grid node
  • entity A can delegate control to entity B (e.g., users, clients, etc.) directly by updating the ACL of machine X.
  • Machine X will grant access to entity B as long as entity A's access is valid.
  • entity B's access will expire as well.
  • the delegation control process is dynamic.
  • any moderator entity that has control over the node can terminate another entity's access control rights and operations.
  • One goal of the invention is to provide authentication and authorization among grid nodes in a dynamic and real time environment. Although in some embodiment other entitities may access the superauthority, generally, only the moderator needs to access the superauthority; thus, providing flexible access to the grid node in collaborative computing environments.
  • the ACLs can be dynamically updated in real time without disruption of the service and without intervention of a third party. This method is advantageous because it can delegate access control in a distributed system without having to contact a central/third party authority as it is common most systems.
  • each entity needs to be authenticated and authorized.
  • a first entity e.g., the as moderator, may obtain a credential or proxy certificate to access the node A.
  • a regular super authority will deliver this proxy certificate after authentication and an authorization check.
  • the moderator will then present this proxy to node A to gain access. Node A will check that the proxy is valid and signed by the super authority, then grant access to the moderator. Once the moderator controls the application on node A, the moderator will be able change the dynamic ACL for this application instance through a secure connection. Node A will then invite the (N ⁇ 1) other entities to access the application on node A. Each entity X in turn will directly contact node A and show a unique certificate (e.g., X509 certificate, etc.) for authentication purpose through a secure sockets layer (SSL) connection. Node A, after checking authentication of entity X, through regular PKI processes, will check authorization against the dynamic ACL created by the moderator. The entity X will then either be granted or denied access.
  • the entity X in the present embodiment may include client, users or even another grid nodes.
  • the moderator M can delegate its moderator ability to other clients once granted access. This delegation is done securely over a SSL connection with the application on node A. As a result, even if the moderator leaves the application, there are still other moderators who can control the access to the application, either by inviting other clients or denying other clients. With this process, all clients are authenticated and authorized correctly against a grid node without having to contact a third party superauthority for managing authorization. As a result, a scalable and dynamic method for authenticating and authorizing clients to access a grid application is achieved.

Abstract

The method of the invention provides for dynamic on-demand delegation of control and access in a grid computing environment comprising granting authority of a grid node to a first moderator by a superauthority; admitting the first moderator to the grid node; modifying the access control list of the grid node by the first moderator; inviting other entities listed on the access control list to access the grid node; and issuing a unique authorization certificate to each of the other entities, wherein the first moderator controls the inviting of the other entities without contact with or accessing to the superauthority for certification.

Description

    BACKGROUND
  • 1. Field of the Invention
  • The embodiments of the invention generally relate to computer security, and, more particularly, to computer security and access control in grid computing environments.
  • 2. Description of the Related Art
  • With the advent of collaborative computing and data sharing, more and more new modes of interaction have evolved resulting in the use of distributed resources for large-scale scientific research. Work within this collaborative computing environment has led to the development of grid technologies, which have become involved in scientific and enterprise computing.
  • In grid computing, heterogeneous resources distributed geographically are virtualized as a unified whole. Grid computing, as a result, provides enormous opportunity in terms of resource sharing, maximization of resource utilization and virtualization of resources. Grid computing has potential for the not only the scientific community, but also the enterprise information technology (IT) communities.
  • However, there are security issues and implications in the wide-spread use of grid computing. Because grid computing involves running of applications in diverse environments, different types of security issues arise. Issues in security in the area of grid computing can be broadly classified into system level, architectural, and interoperability issues.
  • System level security issues deal with the problem of running a foreign application in one's system. Architectural security issues deal with the development of a secure infrastructure for the grid system. Interoperability issues include establishing a secure infrastructure including encryption, authentication and authorization in a grid based environment.
  • Current grid solutions for dealing with authentication and authorization rely on a Public Key Infrastructure (PKI) where every end entity owns a X509 certificate and authentication against grid nodes are done through common PKI mechanisms with a trusted authority. However authorization is handled at a different level, usually by the means of a separate asynchronous process like grid-map files. This second process is not dynamic and is difficult to tie with the authentication process in an on demand environment where authorization can be granted and denied on demand.
  • U.S. Pat. No. 6,901,448, incorporated herein by reference, discloses a method for a distributed collaborative computing environment and a security protocol involving encryption processes. U.S. Pat. No. 7,028,181, incorporated herein by reference, discloses a system and method for revocation of a signature certificate in a PKI.
  • SUMMARY
  • The method of the present invention provides for flexible on-demand authorization and authentication of entities wishing to access grid nodes, when the grid is used for real time collaboration between different parties. The method of the invention provides for dynamic on-demand delegation of control and access in a grid computing environment comprising: granting authority of a grid node to a moderator by a superauthority; admitting the moderator, which is a user having special access, to the grid node; modifying the access control list of the grid node by the moderator; inviting other entities listed on the access control list to access the grid node; and said moderator issuing a unique authorization certificate to each of the other entities, wherein the moderator controls the inviting of the other entities without the need for contact with or access to the superauthority for certification.
  • In view of the foregoing, an embodiment of the invention provides that the modification of the access control list of the grid node includes adding or deleting/removing other entities (e.g., client, users, etc.) on the grid node's access control list. Embodiments of the invention further comprise the moderator delegating authority to priviledged users or additional moderators. The moderator controls the delegation of privileged users or additional moderators without contacting or accessing the superauthority for certifications or authorization. It will be understood to those of skill in the art that as used herein, the terms additional moderator or priviledged user may be used interchangeably herein.
  • In another embodiment of the invention, the modification of the access control list can be performed by either the moderator or the priviledged user. The privileged users, however, cannot revoke or remove the moderator's authority to assign new priviledged users or moderators or assign new users to the access control list of the grid node. The priviledged users or additional moderators can delegate other moderators in addition to modifying the access control list.
  • These and other aspects of the embodiments of the invention will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. It should be understood, however, that the following descriptions, while indicating preferred embodiments of the invention and numerous specific details thereof, are given by way of illustration and not of limitation. Many changes and modifications may be made within the scope of the embodiments of the invention without departing from the spirit thereof, and the embodiments of the invention include all such modifications.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The embodiments of the invention will be better understood from the following detailed description with reference to the drawings, in which:
  • FIG. 1 illustrates a flow diagram illustrating a preferred method of an embodiment of the invention.
  • FIG. 2 is a schematic diagram of a the communication network of moderator, superauthority, node and client (user); and
  • FIG. 3 is representative hardware environment for practicing the embodiments of the invention.
  • DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
  • The embodiments of the invention and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. It should be noted that the features illustrated in the drawings are not necessarily drawn to scale. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments of the invention. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments of the invention may be practiced and to further enable those of skill in the art to practice the embodiments of the invention. Accordingly, the examples should not be construed as limiting the scope of the embodiments of the invention.
  • As mentioned, there remains a need for flexible on-demand authorization and authentication of entities wishing to access grid nodes, when the grid is used for real time collaboration between different parties. The embodiments of the invention achieve this by providing a method for dynamic delegation of control in a grid computing environment. Referring now to the drawings, and more particularly to FIGS. 1 through 3 where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments of the invention.
  • The invention, described herein, delegates control of a node in a grid environment in a scalable and dynamic way. FIG. 1 illustrates a flow diagram of the. A method for dynamic delegation of control in a grid computing environment comprising: granting authority of a grid node to a moderator, which is a user having special access, by a superauthority (100); admitting the moderator to the grid node (102); modifying an access control list (ACL) of the grid node by the moderator (108). The modification of the access control list includes adding or deleting other entities (e.g., users, clients, etc.). The method further comprises inviting the other entities listed on the access control list to access the grid node (104); and the moderator, or in certain embodiments, priviledged user, issuing a unique authorization certificate to each of the other entities (106), wherein the moderator controls the inviting of the other entities without the need for the moderator or the other entities to contact the superauthority for authorization certificates.
  • The method further comprises steps wherein the moderator delegates authority to privileged users (additional moderators) (110). Again, the first moderator controls the delegation of privileged users having moderator abilities without the need for contact with the superauthority. The first moderator and privileged users have the authority to modify the access control list and assign or remove new moderators. However, the privileged users have all the authority of a moderator with the exception that privileged users may not remove the first moderator from the grid node. The moderator may remove himself from the node and assign a new moderator, having the full authority of the first moderator.
  • Moderators can be considered within the context of the invention users with the same privileges of a super authority, i.e., “super users.” Thus, moderators have superior access control and abilities that the regular users do not have. The super authority, is an authority which grants authorization certificates to moderators of a node and can make a regular user a ‘super user’ or moderator, by granting specific credentials (X509 certificates usually).
  • A moderator, e.g., a super user, can make other people privileged users, but not super users, as only the super authority can make those people super users. Privileged users, i.e., additional moderators, are granted different abilities. The most basic one is to get access to the resources, and the other ability they can be granted by the super user/moderator is the ability to make other people privileged users and/or remove their privileged ability. The only thing that privileged users will not be able to do is revoke the ‘super user’ ability of the super user. In that sense, the super user will always have overriding capabilities over its delegated privileged users. A super user/moderator can grant any capability to privileged users can be anything and everything, and should not be limited, e.g., granting access to local machine/node and granting ability to delegate this access to other people.
  • Another embodiment of the invention involves a computer program product readable by machine, tangibly embodying a program of instructions executable by said machine to perform the method for dynamic delegation of control in a grid computing environment described herein. Yet another embodiment of the invention is a service for dynamic delegation of control in a grid computing environment comprising: granting authority of a grid node to a first moderator by a superauthority; admitting the first moderator entity to the grid node; modifying an access control list of the grid node by the first moderator; inviting other entities listed on the access control list to access the grid node; and issuing a unique authorization certificate to each of the other entities.
  • FIG. 2 illustrates schematically the various entities in the method described herein. The moderator receives a certificate from the central authority/superauthority (200) to access the grid node (206) and to modify access to the grid node. The moderator (204) which controls modification of the access control list, assignment or removal of clients (e.g., user, entities, etc.) (202) to the grid node (206).
  • FIG. 3 illustrates a flow diagram according to an embodiment of the invention. The embodiments of the invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment including both hardware and software elements. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
  • Furthermore, the embodiments of the invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can comprise, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
  • The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.
  • A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
  • Input/output (I/O) devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers. Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
  • A representative hardware environment for practicing the embodiments of the invention is depicted in FIG. 3. This schematic drawing illustrates a hardware configuration of an information handling/computer system in accordance with the embodiments of the invention. The system comprises at least one processor or central processing unit (CPU) 10. The CPUs 10 are interconnected via system bus 12 to various devices such as a random access memory (RAM) 14, read-only memory (ROM) 16, and an input/output (I/O) adapter 18. The I/O adapter 18 can connect to peripheral devices, such as disk units 11 and tape drives 13, or other program storage devices that are readable by the system. The system can read the inventive instructions on the program storage devices and follow these instructions to execute the methodology of the embodiments of the invention. The system further includes a user interface adapter 19 that connects a keyboard 15, mouse 17, speaker 24, microphone 22, and/or other user interface devices such as a touch screen device (not shown) to the bus 12 to gather user input. Additionally, a communication adapter 20 connects the bus 12 to a data processing network 25, and a display adapter 21 connects the bus 12 to a display device 23 which may be embodied as an output device such as a monitor, printer, or transmitter, for example.
  • More particularly describing the invention, a third party is not required for the delegation of control during the process to achieve scalability. Once entity A (e.g., the moderator) has gained control over machine X (e.g., the grid node), through regular grid access control approaches, entity A can delegate control to entity B (e.g., users, clients, etc.) directly by updating the ACL of machine X. Machine X will grant access to entity B as long as entity A's access is valid. When entity A's access expires, entity B's access will expire as well. Thus, the delegation control process is dynamic. At any time, any moderator entity that has control over the node can terminate another entity's access control rights and operations. One goal of the invention is to provide authentication and authorization among grid nodes in a dynamic and real time environment. Although in some embodiment other entitities may access the superauthority, generally, only the moderator needs to access the superauthority; thus, providing flexible access to the grid node in collaborative computing environments.
  • Only one entity needs to contact a super authority to get access to a grid node. All other entities will be able to authenticate and authorize against this grid node without having to access a third party (e.g., superauthority). The ACLs can be dynamically updated in real time without disruption of the service and without intervention of a third party. This method is advantageous because it can delegate access control in a distributed system without having to contact a central/third party authority as it is common most systems.
  • Even more particularly, assuming N entities need to connect to grid node A for collaboration, each entity needs to be authenticated and authorized. A first entity, e.g., the as moderator, may obtain a credential or proxy certificate to access the node A. A regular super authority will deliver this proxy certificate after authentication and an authorization check.
  • The moderator will then present this proxy to node A to gain access. Node A will check that the proxy is valid and signed by the super authority, then grant access to the moderator. Once the moderator controls the application on node A, the moderator will be able change the dynamic ACL for this application instance through a secure connection. Node A will then invite the (N−1) other entities to access the application on node A. Each entity X in turn will directly contact node A and show a unique certificate (e.g., X509 certificate, etc.) for authentication purpose through a secure sockets layer (SSL) connection. Node A, after checking authentication of entity X, through regular PKI processes, will check authorization against the dynamic ACL created by the moderator. The entity X will then either be granted or denied access. The entity X in the present embodiment may include client, users or even another grid nodes.
  • The moderator M can delegate its moderator ability to other clients once granted access. This delegation is done securely over a SSL connection with the application on node A. As a result, even if the moderator leaves the application, there are still other moderators who can control the access to the application, either by inviting other clients or denying other clients. With this process, all clients are authenticated and authorized correctly against a grid node without having to contact a third party superauthority for managing authorization. As a result, a scalable and dynamic method for authenticating and authorizing clients to access a grid application is achieved.
  • The foregoing description of the specific embodiments will so fully reveal the general nature of the invention that others can, by applying current knowledge, readily modify and/or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments of the invention have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments of the invention can be practiced with modification within the spirit and scope of the appended claims.

Claims (20)

1. A method for dynamic delegation of control in a grid computing environment comprising:
granting authority of a grid node to a moderator by a superauthority;
admitting said moderator to said grid node;
modifying an access control list of said grid node by said moderator; and
inviting other entities listed on said access control list to access said grid node,
wherein said first moderator controls said inviting of said other entities without contact with said superauthority.
2. The method of claim 1, wherein said modifying comprising adding or deleting said other entities on said access control list.
3. The method of claim 1, further comprising issuing a unique authorization certificate to each of said other entities.
4. The method of claim 1, further comprising delegating privileged users by said moderator, wherein said moderator controls said delegating privileged users without contact with said superauthority.
5. The method of claim 4, wherein said modifying of said access control list is performed by either said moderator or said privileged users.
6. The method of claim 4, wherein said delegating of said privileged users is performed by said moderator or privileged users.
7. A method for dynamic delegation of control in a grid computing environment comprising:
granting authority of a grid node to a moderator by a superauthority;
admitting said moderator to said grid node;
modifying an access control list of said grid node by said moderator;
inviting other entities listed on said access control list to access said grid node; and
issuing a unique authorization certificate to each of said other entities;
wherein said moderator controls said inviting of said other entities without contact with said superauthority.
8. The method of claim 6, wherein said modifying comprising adding or deleting said other entities on said access control list.
9. The method of claim 6, further comprising delegating privileged users by said first moderator, wherein said moderator controls said delegating privileged users without contact with said superauthority.
10. The method of claim 9, wherein said modifying of said access control list is performed by either said moderator or said privileged users.
11. The method of claim 9, wherein said delegating of said privileged users is performed by said first moderator or said privileged users.
12. A computer program product readable by machine, tangibly embodying a program of instructions executable by said machine to perform a method for dynamic delegation of control in a grid computing environment, said method comprising:
granting authority of a grid node to a moderator by a superauthority;
admitting said moderator to said grid node;
modifying an access control list of said grid node by said moderator wherein said modeling comprises adding or deleting said other entities on said access control list;
inviting other entities listed on said access control list to access said grid node; and
issuing a unique authorization certificate to each of said other entities;
wherein said moderator controls said inviting of said other entities without contact with said superauthority.
13. The computer program product of claim 12, further comprising delegating privileged users by said moderator, wherein said moderator controls said delegating privileged users without contact with said superauthority.
14. The computer program product of claim 13, wherein said modifying of said access control list is performed by either said moderator or said privileged users.
15. The computer program product of claim 13, wherein said delegating of said privileged users is performed by said moderator or said privileged users.
16. A service for dynamic delegation of control in a grid computing environment comprising:
granting authority of a grid node to a moderator by a superauthority;
admitting said moderator to said grid node;
modifying an access control list of said grid node by said moderator;
inviting other entities listed on said access control list to access said grid node; and
issuing a unique authorization certificate to each of said other entities;
wherein said moderator controls said inviting of said other entities without contact with said superauthority.
17. The service of claim 16, wherein said modifying comprising adding or deleting said other entities on said access control list.
18. The service of claim 16, further comprising delegating privileged users by said moderator, wherein said moderator controls said delegating privileged users without contact with said superauthority.
19. The service of claim 18, wherein said modifying of said access control list is performed by either said moderator or said privileged users.
20. The service of claim 18, wherein said delegating of said additional moderators is performed by said moderator or said privileged users.
US11/453,487 2006-06-15 2006-06-15 Method and system for authorization and access control delegation in an on demand grid environment Abandoned US20070294404A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US11/453,487 US20070294404A1 (en) 2006-06-15 2006-06-15 Method and system for authorization and access control delegation in an on demand grid environment
US12/060,299 US8935417B2 (en) 2006-06-15 2008-04-01 Method and system for authorization and access control delegation in an on demand grid environment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US11/453,487 US20070294404A1 (en) 2006-06-15 2006-06-15 Method and system for authorization and access control delegation in an on demand grid environment

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/060,299 Continuation US8935417B2 (en) 2006-06-15 2008-04-01 Method and system for authorization and access control delegation in an on demand grid environment

Publications (1)

Publication Number Publication Date
US20070294404A1 true US20070294404A1 (en) 2007-12-20

Family

ID=38862809

Family Applications (2)

Application Number Title Priority Date Filing Date
US11/453,487 Abandoned US20070294404A1 (en) 2006-06-15 2006-06-15 Method and system for authorization and access control delegation in an on demand grid environment
US12/060,299 Active 2030-08-15 US8935417B2 (en) 2006-06-15 2008-04-01 Method and system for authorization and access control delegation in an on demand grid environment

Family Applications After (1)

Application Number Title Priority Date Filing Date
US12/060,299 Active 2030-08-15 US8935417B2 (en) 2006-06-15 2008-04-01 Method and system for authorization and access control delegation in an on demand grid environment

Country Status (1)

Country Link
US (2) US20070294404A1 (en)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090228967A1 (en) * 2008-03-05 2009-09-10 Microsoft Corporation Flexible Scalable Application Authorization For Cloud Computing Environments
US20090228950A1 (en) * 2008-03-05 2009-09-10 Microsoft Corporation Self-describing authorization policy for accessing cloud-based resources
US20110307712A1 (en) * 2010-06-11 2011-12-15 Palsamy Sakthikumar Multi-owner deployment of firmware images
US8990900B2 (en) 2010-06-23 2015-03-24 Hewlett-Packard Development Company, L.P. Authorization control
US9118672B2 (en) 2010-11-22 2015-08-25 Microsoft Technology Licensing, Llc Back-end constrained delegation model
US9614851B1 (en) * 2014-02-27 2017-04-04 Open Invention Network Llc Security management application providing proxy for administrative privileges

Citations (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6772350B1 (en) * 1998-05-15 2004-08-03 E.Piphany, Inc. System and method for controlling access to resources in a distributed environment
US20040221037A1 (en) * 2003-05-02 2004-11-04 Jose Costa-Requena IMS conferencing policy logic
US20040254934A1 (en) * 2003-06-11 2004-12-16 International Business Machines Corporation High run-time performance method and system for setting ACL rule for content management security
US20050110609A1 (en) * 2003-01-31 2005-05-26 General Electric Company Methods for managing access to physical assets
US6901448B2 (en) * 2000-12-29 2005-05-31 Webex Communications, Inc. Secure communications system for collaborative computing
US20050138175A1 (en) * 2003-06-20 2005-06-23 Rajendra Kumar Method and system using admission control in interactive grid computing systems
US7007093B2 (en) * 2000-03-01 2006-02-28 Spicer Corporation Network resource control system
US7028181B1 (en) * 2000-06-09 2006-04-11 Northrop Grumman Corporation System and method for efficient and secure revocation of a signature certificate in a public key infrastructure
US20070156813A1 (en) * 2005-11-15 2007-07-05 California Institute Of Technology Method and apparatus for collaborative system
US7424475B2 (en) * 2003-11-19 2008-09-09 Hitachi, Ltd. Emergency access interception according to black list
US7493390B2 (en) * 2002-05-15 2009-02-17 Microsoft Corporation Method and system for supporting the communication of presence information regarding one or more telephony devices
US7512965B1 (en) * 2000-04-19 2009-03-31 Hewlett-Packard Development Company, L.P. Computer system security service

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6158010A (en) * 1998-10-28 2000-12-05 Crosslogix, Inc. System and method for maintaining security in a distributed computer network
KR100356672B1 (en) * 2001-12-27 2002-10-19 주식회사 바이로박트 Novel Lactobacillus sp. Strain And Using The Same
US20060294238A1 (en) * 2002-12-16 2006-12-28 Naik Vijay K Policy-based hierarchical management of shared resources in a grid environment
US7421500B2 (en) * 2003-01-10 2008-09-02 Hewlett-Packard Development Company, L.P. Grid computing control system
US7308578B2 (en) 2003-03-06 2007-12-11 International Business Machines Corporation Method and apparatus for authorizing execution for applications in a data processing system
JP4522061B2 (en) * 2003-07-31 2010-08-11 キヤノン株式会社 Information processing apparatus and method, and program
US20070112574A1 (en) * 2003-08-05 2007-05-17 Greene William S System and method for use of mobile policy agents and local services, within a geographically distributed service grid, to provide greater security via local intelligence and life-cycle management for RFlD tagged items
US7937406B2 (en) 2003-09-11 2011-05-03 Oracle America, Inc. Mechanism for automatically establishing a resource grid
US7380129B2 (en) 2004-04-22 2008-05-27 International Business Machines Corporation Method and apparatus for detecting grid intrusions
US7961637B2 (en) 2004-06-07 2011-06-14 Spirent Communications Of Rockville, Inc. Method and apparatus for monitoring latency, jitter, packet throughput and packet loss ratio between two points on a network
WO2006086575A2 (en) * 2005-02-09 2006-08-17 Cluster Resources, Inc. System and method of providing a fixed time offset based dedicated co-allocation of a common resource set
US7657746B2 (en) * 2005-04-22 2010-02-02 Microsoft Corporation Supporting statements for credential based access control
US7676539B2 (en) * 2005-06-09 2010-03-09 International Business Machines Corporation Methods, apparatus and computer programs for automated problem solving in a distributed, collaborative environment
US20080005115A1 (en) * 2006-06-30 2008-01-03 International Business Machines Corporation Methods and apparatus for scoped role-based access control

Patent Citations (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6772350B1 (en) * 1998-05-15 2004-08-03 E.Piphany, Inc. System and method for controlling access to resources in a distributed environment
US7007093B2 (en) * 2000-03-01 2006-02-28 Spicer Corporation Network resource control system
US7512965B1 (en) * 2000-04-19 2009-03-31 Hewlett-Packard Development Company, L.P. Computer system security service
US7028181B1 (en) * 2000-06-09 2006-04-11 Northrop Grumman Corporation System and method for efficient and secure revocation of a signature certificate in a public key infrastructure
US6901448B2 (en) * 2000-12-29 2005-05-31 Webex Communications, Inc. Secure communications system for collaborative computing
US7493390B2 (en) * 2002-05-15 2009-02-17 Microsoft Corporation Method and system for supporting the communication of presence information regarding one or more telephony devices
US20050110609A1 (en) * 2003-01-31 2005-05-26 General Electric Company Methods for managing access to physical assets
US20040221037A1 (en) * 2003-05-02 2004-11-04 Jose Costa-Requena IMS conferencing policy logic
US20040254934A1 (en) * 2003-06-11 2004-12-16 International Business Machines Corporation High run-time performance method and system for setting ACL rule for content management security
US20050138175A1 (en) * 2003-06-20 2005-06-23 Rajendra Kumar Method and system using admission control in interactive grid computing systems
US7424475B2 (en) * 2003-11-19 2008-09-09 Hitachi, Ltd. Emergency access interception according to black list
US20070156813A1 (en) * 2005-11-15 2007-07-05 California Institute Of Technology Method and apparatus for collaborative system

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090228967A1 (en) * 2008-03-05 2009-09-10 Microsoft Corporation Flexible Scalable Application Authorization For Cloud Computing Environments
US20090228950A1 (en) * 2008-03-05 2009-09-10 Microsoft Corporation Self-describing authorization policy for accessing cloud-based resources
US8196175B2 (en) 2008-03-05 2012-06-05 Microsoft Corporation Self-describing authorization policy for accessing cloud-based resources
US8418222B2 (en) 2008-03-05 2013-04-09 Microsoft Corporation Flexible scalable application authorization for cloud computing environments
US20110307712A1 (en) * 2010-06-11 2011-12-15 Palsamy Sakthikumar Multi-owner deployment of firmware images
US8566613B2 (en) * 2010-06-11 2013-10-22 Intel Corporation Multi-owner deployment of firmware images
US8990900B2 (en) 2010-06-23 2015-03-24 Hewlett-Packard Development Company, L.P. Authorization control
US9118672B2 (en) 2010-11-22 2015-08-25 Microsoft Technology Licensing, Llc Back-end constrained delegation model
US9614851B1 (en) * 2014-02-27 2017-04-04 Open Invention Network Llc Security management application providing proxy for administrative privileges

Also Published As

Publication number Publication date
US8935417B2 (en) 2015-01-13
US20080183872A1 (en) 2008-07-31

Similar Documents

Publication Publication Date Title
CN108293045B (en) Single sign-on identity management between local and remote systems
Chakrabarti Grid computing security
US7770206B2 (en) Delegating right to access resource or the like in access management system
US9292673B2 (en) Virtual key management and isolation of data deployments in multi-tenant environments
US20190281046A1 (en) System and method for transferring device identifying information
CN111316267B (en) Authentication using delegated identity
US8095969B2 (en) Security assertion revocation
EP3777022B1 (en) Distributed access control
US8935417B2 (en) Method and system for authorization and access control delegation in an on demand grid environment
Dramé-Maigné et al. Centralized, distributed, and everything in between: Reviewing access control solutions for the IoT
Benedyczak et al. Key aspects of the UNICORE 6 security model
Hussein et al. Access control in IoT: From requirements to a candidate vision
Bharill et al. A secure key for cloud using threshold cryptography in Kerberos
Laccetti et al. A framework model for grid security
US20110113481A1 (en) Ip security certificate exchange based on certificate attributes
Fang et al. XPOLA–An Extensible Capability-based Authorization Infrastructure for Grids
Ramakrishnan Securing next-generation grids
Milenković et al. Using Kerberos protocol for single sign-on in identity management systems
Xiao et al. A review of geni authentication and access control mechanisms
Gao et al. Shibboleth and community authorization services: Enabling role-based grid access
US20230239285A1 (en) Secure inter-application communication with unmanaged applications using certificate enrollment
Jang System Access Control Technique for Secure Cloud Computing
Chrysoulas Shielding the grid world: An overview
US20230362162A1 (en) Delegation based access to secure systems
Vullings et al. Secure federated authentication and authorisation to grid portal applications using saml and xacml

Legal Events

Date Code Title Description
AS Assignment

Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BOUTBOUL, IRWIN;REEL/FRAME:018102/0172

Effective date: 20060609

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION